Ethereum Foundation DevCon 6 - Security Track, 12 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: The $10B Problem - web3 Security Against Coordinated Adversaries | Devcon Bogotá

Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/the-dollar10b-problem-web3-security-against-coordinated-adversaries/

Bored Ape Yacht Club Discord hacked, Ronin Bridge compromised, the news articles are fraught with Ethereum exploits. Chainalysis has identified that these attacks are often executed by a small circle of well-funded, well-coordinated adversaries. In this session, Chainalysis examines how these actors operate, how we investigate the flow of funds to try to disrupt attacks, and how the web3 community can work together to raise costs for attackers using the transparency of public blockchains.

Speaker(s): Julia Hardy, Adam Hart
Skill level: Intermediate
Track: Security
Keywords: Hack,Investigation

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

A

A

Thank you. Everyone for joining this talk, I'm, Julia, Hardy I'm here with Adam Hart, and we're here from chain analysis to talk to you about the 10 billion dollar problem, so we're looking at coordinated adversaries that are working within ethereum and the web 3 space. First, you might be wondering who is chain analysis. Why do we care about this issue?

A

She analysis is a blockchain analytics company, so what we do is we take the raw blockchain data as well as inputs that we have from research and from services, and we enhance that data, so we cluster, so we put different addresses that we know are controlled by the same entity together.

A

We also provide attribution- and we put all of that together into our different products, that we have and the one that we use as investigators mainly is reactor, which is our blockchain visualization tool, and so what we're doing in our day-to-day is we're looking at um what have been different exploits that have happened, we're mapping out that activity on chain and when we're looking back at the past year, it can feel like there's, been an exploit every week, if not every day.

A

In some cases, some of these have been the larger Bridge, our flights that have been discussed today, um there's even the BNB Chain Bridge just last week. There are things like the discords and the twitters that have been compromised and they end up having phishing links posted on them. There are things like the Oracle exports that come out and what we do is we Trace? What has happened with those funds and we look for patterns of activity and, ultimately we're asking the question to ourselves.

A

Do we think that these are all separate events that have occurred in the past year or do we see any coordinated attacks happening? Do we see that there are the same adversaries that are working and having multiple exploits in the space and, as you might imagine from our title, we do see some coordination here.

A

So first we're going to talk about the nation-state adversary and about North Korea and in the past, you've probably heard that North Korea has been attributed to the Ronin bridgehawk, but you might not know the extent of their activity and she announces has identified 42 different dprk hacks since 2016., and this is a total of 2.7 billion dollars worth of stolen funds.

A

So this is a pretty crazy number, pretty large um part of the defy exploits that have occurred, and when we look at what kind of exploits they are conducting, we see that they're really following the money. So originally there was most of the money concentrated in Bitcoin and then, as ethereum has taken off as there's been D5 summer and yield farming and nft trading. We see that dprk has shifted and they're focusing a lot more on stealing ether and erc20 tokens.

A

So this is a map of the flow of funds for the Ronin Bridge hack, and this is really a high level view, but you can imagine if you're zooming in each of these dots here is a separate address or a separate group of addresses and the lines between them are flow funds. So you can see just how well coordinated this adversary is they are able to move funds 24 7 across blockchains through mixers and just are very well resourced and well understanding of how to launder in this space.

A

So we can also use those patterns that we see from Ronin from other hacks to be able to identify how dprk works so from there. We can look at past hacks that have happened and say well. Do we think this was actually dprk? Are they following these same laundering strategies, but we just didn't know before, and we can also look forward and if a future exploit occurs, we can take a look and say: do we see these same patterns happening there?

A

Do we think that this is another DPR connectivity and then, hopefully, ultimately help to prevent the flow funds to cash out points.

B

Great um and so Julia just walked us through a very brief overview of some of the the North Korean activity and there's definitely been talks in this room earlier today about exactly how some of those uh you know those attacks are actually executed. But uh what we really wanted to dive into in this session are some of the coordinated adversaries that maybe receive a little bit less media attention, but are equally, if not more damaging to the ecosystem, so dprk definitely a major threat, one that deserves all of the attention that it gets.

B

um It's just that on chain. We we certainly see other activity as well, so.

B

And Julia, which one goes forward there we go um perfect. So you know a common problem that we come across as Julia mentioned earlier. uh Is the you know, sheer volume of hacks exploits other other event, scams that occur, um and the question that that we're always trying to ask is: are these different entities that are all just copying each other or is this one coordinated adversary? um Because if it's a coordinated entity, then they're, probably more sophisticated, more organized, probably doing more damage um and the the attack vectors can vary.

B

So it can be something like compromised web 2 infrastructure. We, we just had a really great talk uh in this room about how how those sorts of exploits occur. um But one of our questions is, you know: is this the same entity? That's maybe uh going after DNS registrations or is it different entities, and the same goes for any sort of compromise of, say, a Discord server or a popular Twitter profile, a trusted method of communication.

B

That again, you know tricks users uh into doing something that they, they probably shouldn't, be doing on the blockchain and uh the way we sort of approach. This problem of you know identifying coordinated entities in the first place is a combination of traditional cyber security analysis. So, looking at things like what infrastructure is used in the attack, you know what systems are compromised.

B

What's the specific attack Vector, but then, uh as as was just shown in the case of looking at North Korean activity, uh but what we can also apply to sort of these other coordinated actors is looking at what occurs on the blockchain. So this is where the the transparency of you know, something like ethereum is really really useful to us.

B

As security analysts trying to sort of understand these Bad actors, uh because we can look at things like how is the victim actually losing funds, and that might be something really sophisticated like a re-entrancy, you know uh exploit in in a popular smart contract, or it can be something as simple as fishing for token approvals.

B

You know the the simple attacks sometimes are the most damaging, uh but you know the the precise sort of payload can be very illustrative and help us understand these groups and then also we can track the funds after the attack occurs now. Unfortunately, this is reactive. This is, after victims are losing money, but again it can help us understand our our adversaries, the the Bad actors on the blockchain better and start to map out the the true sort of scale of the challenge that we're up against here.

B

So to delve into that a little bit, uh we actually wanted to spend a little time here, walking through a case study of how how we approach this problem uh and also hopefully drive home. The point that you know North Korea, is definitely not the only coordinated adversary out there. uh So the particular example here is something that we refer to. As a uh you know: tether usdt approval mining scam so to the folks in this room, those words might not really make sense together right. You know, you don't mind anything with tether.

B

uh You know what's going on here, uh but the essentially the the attack here is not targeting folks who are attending Devcon. This is a targeting. You know newer crypto users, primarily targeting mobile crypto users, folks, who are maybe uh getting into the ecosystem for the first time, the next billion users, um but instead of you know engaging with a a normal. You know dap or you know something interesting. uh Instead, the users are maybe social engineered into going to a website.

B

Maybe they have some tether in their wallet uh and they hear from a trusted friend that they met on the internet, uh that there's this really great opportunity to make some money and they don't even have to send their tether anywhere, because you know they, you know red flags go up. If you send your token somewhere, but they just go onto this site.

B

They, you know, buy a little uh voucher to participate in this node mining um and from there they can start earning some pretty great rewards, and everyone knows you know you can make some money off off of crypto. That's that's always nice, um however, as was very well reported by the metamask security team, it turns out that naturally, this was not the the true application. What was really happening here is when the users were going on to this uh website. What they were seeing was.

B

You know some screen that said: hey, you're, earning great rewards, um all you have to do is buy a little voucher to claim those rewards, but when they bought that voucher, what they really did was approve another address to move the tether sitting in their wallet and again this is a really common attack. Factor, certainly not a new one. It's been around forever, but it still tricks a lot of users.

B

Users don't understand what this approval is, that they're signing and naturally, once the bad actor gets the user the victim to approve their address, to move their funds. They can now clean out all the tether. That's sitting in that address and what we can see thanks to the great work of metamask, is metamask as a very popular wallet provider, they've received lots of tickets from users who had been scammed and they noticed a trend on the off-change side. They noticed a a similarity in how these users were being tricked.

B

They noticed similarities in some, some of the domains being used to to you know, trick these users and from that they published a awesome, Doom dashboard showing 60 addresses that were scamming users, IE 60 addresses that were being granted approvals from victims and those 60 addresses had managed to scam somewhere in the range of 83 million dollars over the course of a year. Now, that's that's already in the range of some of the major Bridge hacks.

B

However, we can go beyond this right because metamask as a wallet provider they're the first point of contact, they're they're, getting the reports from users, but uh what we do as a blockchain analytics company is we try and build out patterns um so here with 60 addresses, we can look in a variety of directions, um so the reported scam addresses are shown here and one of the first things that we might do in investigation is say: okay, how were these different addresses funded?

B

How did they get the ether that they needed to execute transactions on the blockchain again? This is one of many avenues that we pursue, um but you know from there we might be able to identify related addresses and from there maybe we can start identifying some patterns.

B

Maybe we noticed there are some addresses that appear to be testing these phishing scripts right, they're, they're, testing, the approval function, they're funded from the same entities clearly related to what's going on here and uh with that pattern, recognition by looking, you know at the funding by looking at these. These uh you know testing patterns and others.

B

We can start to identify additional addresses that are receiving approvals from victims that are following this exact same pattern of getting that approval from the victim and then transferring the tether out, everything looks alike, um and so now you know we're starting to expand our our understanding of the adversary. Here, where things really get interesting, though, is when adversaries are, are coordinated and organized, as is the case here. um This is a persistent scam that that's, uh you know lasted over a year. There is some point of con.

B

You know consolidation, some pattern we can identify and we identified a consolidation Point here funds were being gathered in a very specific Manner and from that consolidation point we can really start to understand the true scale of this scam, and it turns out uh that when we really mapped out this scam- and certainly the mapping is not complete here- uh we were able to go from the 60 addresses that metamask reported from from their victims um to 91 additional addresses that we identified doing the exact same thing, where we are very confident that they're all controlled by the same entity.

B

So these 91 addresses plus the original 60 addresses they take victim funds and they spread them out to all sorts of addresses. They spread them out to 879 other addresses um so already we're again seeing a very clear laundering pattern as Julia we'll get into in just a moment. But you know we we can start to map out where those funds go and additionally, we can identify how many victims are actually being hurt by this scam, so metamask in their original Doom dashboard, which again you know they they did a fantastic job publicizing.

B

This um and you know we wouldn't be able to get started without their work, but here we were able to identify more than 11 000 additional victims, and this is where these sorts of persistent scams, although less technically sophisticated than something like an exploit, really damaged the community, because now we've got over 20 000 likely victims, and these likely victims are probably first-time users and they're going to go. Tell all their friends that you know their only experience in crypto is getting scammed.

B

uh So you know this is a real problem, and certainly you know the scale is pretty shocking as well, but to truly understand the scale of of these sorts of scams. We also not only have to map out the infrastructure being used to scam victims, but also where the funds go after the attack and for that I'll pass it back over to Julia.

A

Yeah, so looking back at, where do the funds go once they have been stolen and gone to those recipient addresses? We see a really clear pattern of activity and what we're going to show here is just one example, but you can just imagine it across hundreds of addresses.

A

So first we see that the funds are received from the different victims and then spread across a few different addresses. They might be doing that to provide liquidity within the other addresses that they have within this network. They might be doing that to obfuscate the flow funds.

A

We can't really be certain, but what we do see is, after that initial spreading out, we see a consolidation point, and this is just one address or one line here from one address, but imagine that there are tens of different addresses, hundreds of different addresses that are all consolidating to this one address right here and consolidating all those different victim funds.

A

Then we see the funds move to New, addresses and preparation to start to interact with exchanges, and once we get to the exchanges at the bottom, the numbers are pretty staggering. We see 10 million going to a single deposit address at an exchange on one line there 31 million add another, and when we tally up all of those different values that we see from this flow funds, we end up finding 143 million dollars worth of additional stolen value. So in combination with what metamask initially provided, we have a 227 million dollar scam.

A

This is by this point in the top five B5 exploits category, and this is just from all the different victims, all the different users that in aggregate are ending up being just as big of a of an activity.

A

Now this is the known value. When we look at that entire network and look at what funds are actually going to exchanges, we see 1.2 billion dollars, so we can't know without further investigation that all of those funds are coming from this one tether scam, but it shows what the upper bounds of this scam value could really be.

A

The other thing is that we do see that on-chain coordination, we see that the same recipient addresses are being used across different transfer from scammer addresses. So we can. We see the consolidation points, we know that there is definitely some coordinated activity here and that there is one actor behind at least the majority of this exploit, and we can take this a step further.

A

So we can do probabilistic analytics on other addresses and say: do we see other addresses that are showing the same pattern of activity as the ones that we've manually identified and with that we see another 375 potential addresses.

A

So this is just one example of us working with metamask to find the scam and find its full levels. But really we want this to be a starting point and we really want all of us, as a community, within the security space, to try to work a lot more closely together and we can raise the cost for Bad actors by trying to use some of these different points.

A

um This is something that is not just unique to us. We know that those that are working in the ransomware space have done a good job with trying to work a lot more collaboratively, and we think we can do a lot of the same things here so trying to have more data sharing between the victims and the incident response. Firms trying to use blockchain analytics more and focus on that combination of off-chain and on chain together, trying to have more public private collaboration and trying to identify Trends and share that research with each other.

A

So we're all kind of working right now, a little bit more in our own silos. But maybe we can start a conversation about how we can start to communicate more and try to use all these assets that we have to our advantage to prevent the next year, having quite as many exploits as this year.

A

So with that, we thank you very much. We would really like to talk with each and every one of you after this. If you have any ideas about how we can collaborate or where we should take this from this point here definitely feel free to follow us and reach out to us. I think we have a couple minutes. If anyone has any questions offhand.

B

A

B

So the question was um in the traditional cyber security space. uh We we talk about. You know apt's advanced persistent threats, whereas we use the term coordinated adversaries.

B

um We didn't want to confuse the the cyber security side of things, because maybe some of these coordinated adversaries aren't, you know really at an advanced super tech, sophisticated threat, but mostly it's just terminology of choice. Yeah.

C

So in the case that we saw here, we um we were presented, something that was not supposedly uh looking like. It came from the Lazarus group or the dprk, but why? Why does this not look like it comes from from the DPR care of the Lazarus group.

A

I mean exactly for the reasons that we were talking about so using that off chain and on-chain pattern and from what we have historically known, how um Lazarus tends to provide spear phishing or use certain methods off-chain how they tend to launder on chain. It just isn't following that pattern, foreign.

D

Thank you for the talk today. uh Briefly, you mentioned that you used uh checking how wallets were funded as a means to investigate what were the other tactics that I heard. You say we use other tactics. What are the other tactics that you use? Yeah.

B

I'll, take that one, so my my day, job is actually to to run training courses on that. Unfortunately, it's going to take like eight hours to to really get to delve into that one, um but you know there there's a lot of different directions to look in generally. We we look both forward and backwards to see.

B

You know where the funds are going where they came from, and then you know a lot of times with a persistent group like this there's some sort of testing effort as well mapping out the testing effort can be often very illustrative, um but you know we can definitely chat more on the side.

A

Foreign I think we can do one more probably.

B

So so the question was uh with respect to, to you know: uh ZK, Roll-Ups and and other DK chains. um You know how does that potentially interfere with blockchain analytics uh it? It definitely depends. I'll I'll, give you the the non-answer there.

B

um Different chains come with with different considerations there, uh but you know, as as our co-founder stated, you know, these groups, especially Lazarus, are moving something like 600 million dollars in a shot, like that's that's kind of tougher to hide. So if you're operating on that volume, it's it's hard to hide that amount.

A

Well, thank you, everyone and definitely feel free to find us later.